improve capture executed files

From: #208

there's still an edge case where capture executed files won't work: if a container with shared pidns started and exists, and another one is started that uses the same mntns, then the pids cache won't get updated. It's still an improvement over the current state, but not perfect.

to fix that we need a way to know when a mnt ns is created (or destroyed), and clear the mntns cache record

related #215

Start by tracing the capture executed files entry point and the mntns and pids cache handling, then read related issues #208 and #215 for context. Done means the cache record is cleared when a mount namespace is created or destroyed and the shared-pidns, shared-mntns edge case updates the cache correctly.

Written by the indexing model from the issue text.